Top 7 Network TAPs for Darktrace and NDR Sensors

Network detection and response (NDR) tools are only as good as the packets they receive. Darktrace, Vectra, ExtraHop and Corelight all depend on mirrored traffic. If that feed drops packets, the model learns an incomplete picture of normal. Lateral movement can slip through without an alert.

Most NDR rollouts start on SPAN ports because they are already there. That works until traffic peaks. A switch can only run a few SPAN sessions, and it drops packets without warning when oversubscribed. The sensor never knows what it missed.

Hardware TAPs and packet brokers fix the access layer. They copy every packet, trim the feed to what the sensor needs and spread the load across appliances. This guide compares seven vendors on how well they feed Darktrace and other NDR sensors.

NDR Sensor Feeds at a Glance

1. Network Critical

Network Critical: SmartNA-PortPlus, SmartNA-PortPlus HyperCore, Drag-n-Vu

Network Critical builds the access and brokering layer that sits in front of NDR sensors. The SmartNA-PortPlus scales from 48 to 194 ports at 1G to 100G. It delivers 1.8 Tbps of non-blocking, line-rate throughput in a 1RU base unit. You grow it by adding 48-port units, so the first chassis is never replaced.

For core links, the SmartNA-PortPlus HyperCore moves to 400G. It offers 32 QSFP-DD interfaces and 25.6 Tbps of bi-directional visibility.

Two features matter most for NDR. Session-aware load balancing splits traffic by IP, protocol, port, VLAN or MAC address. Each sensor in a cluster sees complete sessions, not fragments. The integrated API uses HTTP and JSON and exposes every setting in the GUI. That lets a tool like Darktrace change its own filters and port maps without human input.

Drag-n-Vu handles day-to-day configuration through drag-and-drop filters. Its rule optimisation engine saves up to 70 per cent of system rule resources. One-click rollback restores a previous configuration if a change goes wrong. Output is standard and tool-agnostic, so the same feed can serve Darktrace, Splunk or Wireshark.

Proven results:

• Darktrace: The SmartNA-PortPlus API let Darktrace control filtering and port mapping automatically, adapting to traffic changes without manual work.
• Bourne Leisure: SmartNA-XL connected eight 1Gbps links to one 10Gbps security tool per data centre, an 8x tool CAPEX saving.
• HSBC: Passive optical TAPs fed monitoring tools worldwide with zero latency and zero impact on live traffic.

2. Gigamon

Gigamon: GigaVUE HC Series, GigaVUE-TA400, GigaVUE-FM

Gigamon markets its Deep Observability Pipeline as a feed for NDR and other security tools. Physical TAP and SPAN traffic flows into GigaVUE HC and TA Series nodes. Virtual and cloud traffic arrives through the V Series and mirroring services. GigaVUE-FM manages the whole fabric from one console. Gigamon's NDR brief says the pipeline keeps sensors fully fed as infrastructure scales, including VM and container workloads.

The GigaVUE-TA400 handles 400G link access and high-density aggregation. GigaSMART modules on HC Series nodes process traffic before it reaches a sensor.

Decryption is a key differentiator. Gigamon offers centralised decryption so NDR tools receive decrypted data rather than opaque TLS sessions. Its Precryption technology adds TLS visibility across hybrid cloud workloads.

Gigamon claims 51 per cent of the deep observability segment, according to 650 Group figures for Q1 2026. Its scale suits large enterprises standardising one fabric across data centre and cloud. Budget holders should model the full three-year cost, including any subscription fees.

3. Keysight

Keysight: Vision 400, Vision E400S

Keysight's network visibility line comes from its Ixia acquisition. The Vision 400 and Vision E400S are 1RU packet brokers running from 10G to 400G. Each provides 24 SFP56 and 16 QSFP-DD ports with 9.2 Tbps of line-rate L2 forwarding.

The Vision 400 adds an FPGA-based PacketStack for advanced processing. It performs deduplication, packet trimming and burst protection at 400G. Trimming covers HTTPS and QUIC traffic, which cuts payload volume for NDR tools that work mainly from headers.

Session-aware, weighted and asymmetric load balancing spread traffic across sensor clusters. Header stripping and tunnel termination cover up to 20 protocols on every port. A 100G port can break out to four 25G ports for lower-speed sensors. Timing sources include NTP, 1588 PTP and two independent 1PPS inputs. The Vision 400 series won a 2024 Frost and Sullivan New Product Innovation Award.

Keysight also offers a point-and-click web interface for filter creation. This suits teams who want broker-level processing without writing rules by hand. Visibility is one business unit inside a much larger test and measurement company.

4. Arista Networks

Arista Networks: DANZ Monitoring Fabric (DMF)

Arista's DANZ Monitoring Fabric is a software-defined packet broker. It runs on merchant-silicon switches under a central controller. The fabric collects TAP and SPAN traffic at 1G to 100G and presents it as one logical broker.

Centralised tool farms are the main benefit. Instead of a sensor per site, you can feed shared NDR appliances from many monitoring points. DMF Service Nodes add deduplication, slicing, masking and header stripping. DMF Recorder Nodes store packets for later investigation.

Arista also sells its own NDR platform. Its DANZ Forensic Exchange combines DMF filtering and storage with Arista NDR. DMF still delivers traffic to third-party security tools. You provision the fabric through one controller, using its CLI, GUI or REST API. DMF Labs offers hands-on online evaluation before purchase.

Multi-tenant monitoring lets NetOps, SecOps and CloudOps share the same fabric with separate policies. DMF fits best where Arista switching is already deployed. Organisations running other switch vendors should check hardware compatibility before committing.

5. APCON

APCON: IntellaView, HyperEngine, IntellaStore IV

APCON's IntellaView platform combines modular chassis, interchangeable blades and management software. Chassis range from 1RU to 9RU, with port speeds from 1G to 400G. In 2024 APCON added a 32-port 400G EdgeSwitch and new multi-function blades. Its passive fibre TAPs cover 40G and 100G links in short-range, long-range and bidirectional models.

The HyperEngine blade handles packet processing for security tools. It supports deduplication, application filtering, pattern matching and NetFlow generation. APCON documents up to 400G of total throughput across four concurrent service engines.

IntellaStore IV, launched in February 2026, adds capture and on-box compute. Its APCON Intelligent Processor runs your choice of security applications alongside dedicated packet capture. APCON's own ThreatGuard intrusion detection software can run on it, with a 60-day trial included.

IntellaView Enterprise manages up to 200 APCON switches from one application. ThreatGuard and the Enterprise tier carry annual licences. That makes APCON a fit for teams wanting broker, capture and detection from one vendor.

6. Garland Technology

Garland Technology: Network TAPs, Aggregator TAPs, PacketMAX Advanced Aggregators

Garland Technology is a listed Darktrace technology partner with a published joint solution brief. Many of its TAPs and aggregators include built-in data diode technology. This enforces one-way traffic from the network to the Darktrace appliance.

The joint brief covers two deployment patterns. A Garland TAP passes all traffic from a tapped link to the Darktrace sensor. Where SPAN ports remain, a Garland Aggregator TAP can help. It combines up to eight SPAN or mirror ports into one or two Darktrace appliances.

In January 2024 the two companies announced a Darktrace/OT collaboration. It extends visibility across OT, IT and IIoT networks down to Purdue level 1.

For larger feeds, PacketMAX Advanced Aggregators run from 10G to 100G. The 2U, 64-port model provides filtering, aggregation and load balancing. It manages up to 256 10G interfaces on a single platform. Garland states it charges no licence or port fees. Products are engineered and manufactured in Richardson, Texas.

7. Profitap

Profitap: X2-Series and X3-Series network packet brokers, IOTA

Profitap is a Netherlands-based vendor of TAPs, packet brokers and capture appliances. Its X2-Series brokers reach up to 6.4 Tbps of total throughput, with ports up to 100G.

Profitap publishes a joint solution brief with Vectra's Cognito NDR platform. In that design, X2-Series brokers filter and aggregate traffic from all access points first. They then forward it to Cognito, applying deduplication on the way.

The X2 and X3 ranges list packet slicing, deduplication, timestamping, data masking and SSL/TLS decryption. Packet slicing truncates frames after a set number of bytes, keeping headers and dropping payloads. X2 brokers run up to 6,000 non-conflicting rules in parallel. New rules never override existing ones, which reduces configuration risk on busy sensor feeds.

Profitap also sells the IOTA line, which combines capture and analysis in one device. Supervisor software manages clusters of brokers centrally. Field presence is strongest in Europe, with North American coverage through channel partners.

How to Choose the Right Network TAP for Your NDR Sensors

Size the Feed to the Sensor

Start with the capacity of each NDR appliance, not the speed of the link. A 40G sensor watching 100G of mirrored traffic will drop packets during peaks. Map your tapped links against sensor capacity before you pick hardware. Where traffic exceeds one sensor, you need aggregation and load balancing in front of it.

Replace SPAN on Critical Segments

SPAN ports drop packets silently when they are oversubscribed. Most switches also support only two to four concurrent SPAN sessions. For the segments where lateral movement matters most, use hardware TAPs. Passive optical TAPs need no power and leave the live link untouched if anything fails.

Filter Before Traffic Reaches the Sensor

Every irrelevant packet costs sensor capacity and, for many tools, licence volume. Dedicated network packet brokers remove that waste before it reaches the appliance. When you compare brokers, check for:

• Session-aware load balancing that keeps each flow on one sensor
• Layer 2 to 4 filtering by VLAN, IP address and port
• Packet slicing for tools that only need headers
• Deduplication where several TAPs see the same traffic
• Source port labelling so analysts can trace a packet back to its link

Plan for API-Driven Automation

AI-based NDR tools adapt as the network changes. Your visibility layer should adapt with them. Look for a documented REST API that exposes filters and port maps, not just monitoring counters. A GUI still matters for SOC analysts who need to make changes without a network engineer.

Decide Where Decryption and Masking Happen

Most enterprise traffic is now encrypted. Some NDR tools work from metadata, while others need decrypted payloads. Confirm what your sensor expects, then decide whether decryption sits in the broker, a dedicated appliance or the tool itself. If you handle card or personal data, check payload masking options too.

Model the Three-Year Cost

Hardware price is only part of the bill. Ask each vendor about subscription fees, per-port licences and the cost of adding ports later. Factor in engineering time for deployment and routine changes. A perpetual licence with a modular chassis usually gives you the most predictable three-year spend.

Frequently Asked Questions

Do I need a network TAP for Darktrace?

You can run Darktrace from a SPAN port, but a TAP gives it a complete feed. SPAN drops packets under load, so the sensor learns from partial data. A TAP copies every packet, including errors, without depending on switch resources. Our guide to network TAPs vs SPAN explains the trade-offs in detail.

Should a network TAP connect directly to an NDR sensor or through a packet broker?

Connect directly when one TAP feeds one sensor with spare capacity. Add a packet broker when several links feed one sensor, or one link feeds several tools. The broker aggregates, filters and load balances traffic so no appliance is oversubscribed. Larger deployments often need both layers.

How do I stop my NDR sensor dropping packets?

Reduce the volume reaching the sensor and spread it across appliances. Filter out traffic the tool does not need, such as bulk backup flows. Then load balance by session across a sensor cluster. Check the broker's port counters regularly to confirm no egress port is saturated.

How much does a network TAP for NDR cost?

Pricing varies widely, and most vendors quote on request. In one modelled mid-size deployment, Network Critical put three-year cost at $325K against $680K for a subscription-based incumbent. Ask every vendor for a three-year figure that includes support and licences.

Can one TAP feed Darktrace and other security tools at the same time?

Yes, through a packet broker that replicates traffic to several outputs. A single tapped link can feed Darktrace, an IDS and a packet recorder at once. Each tool can receive a different filtered view of the same stream. This avoids adding a separate TAP for every new tool.

Build Your NDR Visibility Layer With Network Critical

Your NDR investment depends on a complete, correctly sized traffic feed. The right TAPs and brokers decide whether your sensors see everything or guess. Every packet a sensor misses is a detection it cannot make.

Network Critical gives you that feed without the subscription model. Perpetual licensing removes recurring fees. Network Critical's own modelling shows a 40 to 60 per cent lower three-year TCO than subscription incumbents. Drag-n-Vu lets your team configure filters and port maps themselves, with typical deployments completing in under two hours. Network Critical hybrid TAPs combine access and brokering in one chassis. Their standard output works with Darktrace or any other tool you choose.

Planning an NDR rollout or fixing a sensor that drops packets? Speak to the Network Critical team and request a free network audit.